fix: validate OAuth state before token exchange

[ryanduguid]

Summary

• validate a supplied OAuth callback state before the authorization-code exchange
• prevent a mismatched callback from making a token request or overwriting the current token set
• add regression coverage for mismatched, matching, and legacy no-state callback paths

This preserves the SDK's existing optional-state compatibility: callers that do not configure state continue to work. It makes the existing configured-state protection effective before the mutating token exchange occurs.

Validation

• git diff --check

Ruby and Bundler are not available in the audit environment, so I could not execute the repository's normal bundle exec rake spec suite. The new specs are deliberately focused for that CI run.